Sharing access with reverse proxy and VPN reddit / selfhosted ---------------------------------------------------------------------- kaitco · 2023-10-05 20:27 I'm using Jellyfin for the first time and I love it. It works great on PCs and streaming devices on my home network. I understand that I can share Jellyfin with some friends, or even access it outside of my home network. Originally, I was using Tailscale to do this, but the issue there is that Tailscale must be installed and running on each device. This was fine for a phone and tablet, but for devices like a Roku or Firestick, Tailscale isn't really an option, plus when sharing with parents and less techie friends, asking them download an additional app and then trying to screencast doesn't work either. What I'd like to do is setup something so that my friends can access my Jellyfin through a domain on a Roku, and use a reverse proxy so that I'm not opening my network to anything potentially dangerous. All the guides I've seen so far suggest using something like Caddy or nginx, but before even getting to that point, I understand that I need to set my A record for the domain/subdomain to my private IP. **The issue that stops me, however, is that I use a VPN and my private IP changes** as I switch the VPN on and off, or change to different countries. The very first steps [here](https://jellyfin.org/docs/general/networking/caddy/) say "make sure your domain name's A/AAAA records are pointed at your public IP address" and even though [the wiki](https://wiki.r-selfhosted.com/learn/what-are-reverse-proxies/) here states that this *can* be done through a VPN, there's very little information on how to actually do this. I've looked into "split tunnelling" and even managed to have Jellyfin excluded from the VPN tunnel, but I'm still stuck at what steps I actually need to take, so I'm looking for some help to get to the next step. I don't need a domain service because I've already got jellyfin.kaitco.net ready to go and that is where I'd like my friends and family to be able to access my Jellyfin. I was trying to follow [this guide](https://www.reddit.com/r/jellyfin/comments/gdwe0s/windows _and_caddy_v2_reverse_proxy_guide/) as well, but again get stuck because the Port Forwarding (which I *think* I got done on my router) doesn't make a lot of sense to me and again there's the issue of redirecting using DuckDNS or NoIP or something. I have spent hours trying to figure out how to make this work and I feel like I'm really close if I could have some ELI5 explanations for how some of these things work. Any help would be appreciated. (And, *yes* I've seen [this](https://www.reddit.com/r/selfhosted/comments/17 0cfm7/proper_way_of_sharing_jellyfin/) thread already and the recommendations there are Tailscale or going through DuckDNS.) ---------------------------------------------------------------------- ASouthernBoy · 2023-10-05 21:01 what do you exactly mean you use vpn. Do you have a public ip address and are not behind CGNAT, if yes it can be done with port forwarding to your proxy server. if you are behind CGNAT it csn be done with VPS. ---------------------------------------------------------------------- Anejey · 2023-10-05 21:04 You can get a free VPS from Oracle, run a Wireguard that goes from your Jellyfin instance to the VPS, and then point your domain at the VPS IP (where you'll still need some reverse proxy). I used this script to achieve that: https://github.com/mochman/Bypass_CGNAT/wiki ---------------------------------------------------------------------- SenatorBagels · 2023-10-05 21:49 That's against Oracle's ToS and will probably get your account closed. ---------------------------------------------------------------------- Anejey · 2023-10-05 21:53 How so? I didn't do too much research into it, but I'm pretty sure Oracle gives you plenty of bandwidth. I'll look into it later, but so far I haven't had any problems. ---------------------------------------------------------------------- zachfive87 · 2023-10-05 22:05 If you're not behind a cgnat this is what I'd do. 1. Get a duckdns domain. 2. Set up a redirect for your domain jellyfin.kaitco.net to the duckdns domain. 3. Run any one of the duckdns ip update scripts or apps to keep your current wan ip up to date with the duckdns domain. I am on windows and use [this](https://github.com/XWolfOverride/DuckDNS) 4. Forward port 80 and 443 on your router to your machine running jellyfin. 5.set up caddy to reverse proxy your duckdns domain to jellyfin. A working caddyfile would look something like. Duckdnsdomain.duckdns.org Reverse_proxy 192.168.1.15:8096 This is what I do. You could skip using duckdns but if your isp changes your IP address, which is done from time to time you'd need to point your jellyfin.kaitco.net to the new ip address. ---------------------------------------------------------------------- Sum_of_all_beers · 2023-10-05 22:19 The most elegant solution I've hit on for this is to keep two domains. One domain is used only for services you want to share with friends outside your Tailscale VPN, so you set up the A record on that domain (using a wildcard record, *.yourdomain.tld) to point to your public- facing IP address, and open only port 443 on your router. Then use your reverse proxy to create a wildcard TLS certificate that works for all that domain and all subdomains, and then go nuts creating whatever subdomains you want people to be able to reach your services on, like watch.yourdomain.tld for Jellyfin, listen.yourdomain.tld for audiobooks, pissoffhenry.yourdomain.tld for that mate that keeps asking you to share stuff, once you finally relent. The second domain is for services only you should have access to, so you point that domain's A record to the Tailnet IP for your server, and use the same reverse proxy to create subdomains for anything you want to access the web-UI on. I've got subdomains like portainer.samedomain.differenttld, paperless.samedomain.differenttld, etc running. This would not be strictly needed if you only ever accessed them at home and could use the service locally, but this setup makes it more secure to operate those services on any device connected to your tailnet (which for me is just the phone and laptop I travel with). Like others here I haven't had much luck using a free Oracle VM as an exit node for Tailscale, mine worked beautifully for about 2 days and then stopped. Could be because it's against their TOS ... ---------------------------------------------------------------------- zfa · 2023-10-05 22:36 No it isn't? ---------------------------------------------------------------------- zfa · 2023-10-05 22:38 10TB egress is free. More than enough for most people. ---------------------------------------------------------------------- kaitco · 2023-10-05 23:44 If I skipped the DuckDNS part, which IP would I use in the A record for jellyfin.kaitco.net? With my VPN off, I can see a public IP that's 174.101.2xx.1xx. The public IP will change as soon as I turn on ProtonVPN. I know my local/private IP, however, is 192.168.5xx.1xx, but I don't want to connect that to A record because I believe that's unsecured. I'm just really confused about all this... ---------------------------------------------------------------------- zachfive87 · 2023-10-06 00:06 I'm not at all saying I understand fully this networking/ip address mumbo-jumbo, just saying what I did that works for me. But it seems to me, that of you split tunneled the VPN to exclude jellyfin, that it would still be able to reach via your public ip address before you turned on the VPN. So I'd try and point jellyfin.kaitco.net to 174.101.2xx.1xx, and set up the port forward/caddy reverse proxy, amd see of that works while the vpn is enabled. I belive you're seeing a change in your WAN ip because the browser you're using is being the vpn. It's not as if turning on the VPN makes your original IP from your ISP just go away, it's still pointed to you, and with jellyfin being excluded from the vpn, that should, in theory still work to connect your clients too. I would also suggest not skipping the duckdns/any ddns provider, as when your isp changes your ip address, and that will happen eventually, you'll need to re point jellyfin.kaitco.net to that new address. It's not to hard to set up. Again, you'd just point/redirect jellyfin.kaitco.net to the duckdns domain, and in your caddyfile reverse proxy the duckdns domain. ---------------------------------------------------------------------- kaitco · 2023-10-06 00:47 Good deal! I think I'll try this and see if it works out.